EP4352913B1 - Verschlüsselte berechnung mit einer blinden rotation - Google Patents

Verschlüsselte berechnung mit einer blinden rotation Download PDF

Info

Publication number
EP4352913B1
EP4352913B1 EP22821542.2A EP22821542A EP4352913B1 EP 4352913 B1 EP4352913 B1 EP 4352913B1 EP 22821542 A EP22821542 A EP 22821542A EP 4352913 B1 EP4352913 B1 EP 4352913B1
Authority
EP
European Patent Office
Prior art keywords
polynomial
encrypted
ciphertext
modulus
quotient
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP22821542.2A
Other languages
English (en)
French (fr)
Other versions
EP4352913A1 (de
Inventor
Marc Francois JOYE
Michael Walter
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Zama SAS
Original Assignee
Zama SAS
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from EP21290080.7A external-priority patent/EP4195577A1/de
Application filed by Zama SAS filed Critical Zama SAS
Publication of EP4352913A1 publication Critical patent/EP4352913A1/de
Application granted granted Critical
Publication of EP4352913B1 publication Critical patent/EP4352913B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/14—Fourier, Walsh or analogous domain transformations, e.g. Laplace, Hilbert, Karhunen-Loeve, transforms
    • G06F17/141—Discrete Fourier transforms
    • G06F17/144—Prime factor Fourier transforms, e.g. Winograd transforms, number theoretic transforms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/008—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols involving homomorphic encryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/12—Details relating to cryptographic hardware or logic circuitry
    • H04L2209/122—Hardware reduction or efficient architectures

Definitions

  • the presently disclosed subject matter relates to a cryptographic encrypted computation method, to a method of determining a test polynomial, to corresponding devices, and to a computer readable medium.
  • Homomorphic cryptography allows one to perform encrypted computations: computations, e.g., circuit evaluations, that are performed over encrypted data by a party without that party being able to decrypt. For example, input data and computation results may be received and returned in encrypted form. Intermediate data, e.g., an internal state of the computation, may also be in encrypted form.
  • Homomorphic encryption can be used for privacy-preserving outsourced storage and computation. This allows data to be encrypted and outsourced to a cloud environment for processing and/or storage, all while encrypted.
  • homomorphic cryptography may be applied in fields such as health care in which privacy regulations may make it difficult to share plain data, but computations on encrypted medical data may be allowable.
  • a medical model developed, say, to classify medical data may be configured to receive medical data from a third party, say a hospital, in encrypted form.
  • the medical model might, e.g., classify medical data, e.g., as normal or abnormal, or as having some particular medical syndrome, disease, or other disorder.
  • the medical model may be applied to medical data that is received in encrypted form. This means that the party that offers the medical model does not have access to the plain medical data that corresponds to the encrypted medical data.
  • the user of the service can decrypt the result of the medical model application.
  • homomorphic cryptography techniques exist that can be used, at least in principle, to compute any function on encrypted data. Such techniques are referred to as “fully homomorphic encryption” (FHE) techniques.
  • FHE fully homomorphic encryption
  • LWE-type ciphertexts may comprise one or more mask values (e.g., values modulo a certain modulus q, or torus elements), plus a body value which is derived from the mask values and from a plaintext using an encryption key, and which contains the noise.
  • a variant of this is a GLWE-type ciphertext, that encrypts and uses polynomials instead of scalar values.
  • Other known implementations of FHE use NTRU-type ciphertexts, for which the same considerations largely apply.
  • the noise When a data item has just been encrypted the noise is low - the encryption is fresh. For example, the amount of noise is so low, that if a data item were to be decrypted, the noise can be removed at some point in the decryption process, e.g., by rounding. On the other hand, the noise should be high enough to make attacks on the system sufficiently hard. For example, in the hypothetical absence of noise, many homomorphic encryption schemes could be attacked with linear algebra, or other efficient algorithms, e.g., lattice reduction algorithms. When a data item is encrypted, noise is added that is chosen so that attacks are hard while homomorphic operations can still be performed and decryption is still possible.
  • TFHE-like homomorphic encryption schemes A particular class of fully homomorphic encryption schemes are the TFHE-like homomorphic encryption schemes. Such a scheme is described in I. Chillotti et al., "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks", Cyber Security Cryptography and Machine Learning (CSCML 2021), vol. 12716 of Lecture Notes in Computer Science, pp. 1-19, Springer, 2021 .
  • TFHE-like schemes differentiate themselves from other FHE schemes by supporting a comparatively very efficient technique for bootstrapping; in addition, they enable at the same time to evaluate a function during the bootstrap operation, referred to as programmable bootstrapping.
  • the regular bootstrapping corresponds to a programmable bootstrapping with the identity function.
  • This programmable bootstrapping technique can reduce noise in a ciphertext (e.g., an LWE-type ciphertext) by performing a so-called blind rotation.
  • the blind rotation may involve homomorphically evaluating a decryption (e.g., a LWE decryption) in an exponent of an encrypted bootstrapping monomial (e.g., GLWE-encrypted), resulting in an an encrypted (e.g.
  • the output of the blind rotation has an amount of noise that is independent of the noise in the input ciphertext.
  • the noise in the input ciphertext can be reduced to a fixed amount, while possibly at the same time applying a function to the input ciphertext.
  • the known programmable bootstrapping and in particular its blind rotation, has a number of limitations.
  • the blind rotation typically requires that the most significant bit of the scaled plaintext value is set to 0, in other words, the ratio of plaintexts for which a value can be programmed is only 1/2.
  • a cryptographic encrypted computation method is provided, as defined by the claims.
  • a method of determining a test polynomial for use in such an encrypted computation method is provided, as defined by the claims.
  • devices corresponding to these computer-implemented methods are provided, as defined by the claims.
  • a computer-readable medium is provided as defined by the claims.
  • the encrypted computation may involve performing a blind rotation of a ciphertext, e.g., an LWE-type ciphertext; for example, as part of a programmable bootstrapping.
  • the ciphertext may encrypt a certain plaintext ⁇ *, e.g., a scaling of an original plaintext ⁇ .
  • the blind rotation may compute an encrypted polynomial product, e.g., v ( X ) ⁇ X - ⁇ *, of a test polynomial v ( X ) and a bootstrapping monomial representing the plaintext value as an exponent, e.g., X - ⁇ * , in a polynomial ring.
  • the blind rotation may involve computing a number of polynomial products in the polynomial ring.
  • this polynomial ring is the ring Z / qZ X / X N + 1 modulo the modulus q and the quotient polynomial X N + 1, where q and N are both powers of two.
  • the inventors realized that, since polynomial products are a major part of the blind rotation, it would be beneficial to use more efficient techniques to compute the polynomial products in the blind rotation.
  • NTT number-theoretic transform
  • the polynomials may be represented in a so-called Fourier-domain representation of the NTT.
  • a Fourier-domain representation of a polynomial comprises a number of respective evaluations of the polynomial in a number of respective evaluation points.
  • the polynomials may be efficiently multiplied, e.g., by pointwise multiplication of the evaluations.
  • NTT it is possible to efficiently compute the Fourier-domain representation of a polynomial from its coefficient representation (by applying the number-theoretic transform itself) and to efficiently compute a coefficient representation from the Fourier-domain representation (using the inverse number-theoretic transform).
  • Various number-theoretic transforms are known per se, including the Discrete Fourier Transform (defined, in its standard form, for quotient polynomial X n - 1 and prime power modulus q with n
  • performing a polynomial multiplication "using the number-theoretic transform” may generally refer to performing the polynomial multiplication in the Fourier domain of the number-theoretic transform, optionally combined with using the NTT and/or its inverse to convert polynomials from and to this Fourier-domain representation.
  • the inventors found a way to make blind rotation compatible with the number-theoretic transform.
  • each respective coefficient of the test polynomial corresponds to a respective desired output value as was the case in the prior art, e.g., the test polynomial is different from v 0 + v 1 X + ⁇ + v i -1 X i -1 + v i X i + v i +1 X i +1 + ⁇ + v N -1 X N -1 .
  • the test polynomial is different from v 0 + v 1 X + ⁇ + v i -1 X i -1 + v i i + v i +1 X i +1 + ⁇ + v N -1 X N -1 .
  • using such a test polynomial in the blind rotation may result in an encrypted polynomial from which the desired output value can be extracted by extracting the fixed coefficient.
  • the polynomial ring may be defined by a modulus q, which can for example be a power of 2, and by a quotient polynomial p(X), e.g., different from X N + 1.
  • the quotient polynomial may divide an NTT polynomial, namely, a polynomial that allows a number-theoretic transform modulo the modulus q.
  • NTT polynomial is equal to X M - 1, where M is coprime to q.
  • polynomial multiplication modulo the quotient polynomial may be implemented as a polynomial multiplication in the Fourier domain of the number-theoretic transform, e.g., as a polynomial multiplication modulo the NTT polynomial.
  • the blind rotation may be performed modulo the modulus q and modulo the quotient polynomial p(X) dividing the NTT polynomial, and accordingly, polynomial multiplications of the blind rotation may be implemented using the number-theoretic transform.
  • efficiency of the blind rotation is improved compared to the known blind rotation.
  • polynomial multiplication modulo the modulus and the quotient polynomial may occur in other operations of the encrypted computation as well, e.g., in a key switching that may optionally be performed as part of a programmable bootstrapping, these other operations can use the number-theoretic transform as well and can accordingly also be made more efficient.
  • the modulus is a power of two, e.g., the modulus may be equal to 2 32 , 2 64 , or 2 128 .
  • computations may be performed over the ring Z / qZ where q is a power of two.
  • Such a modulus may allow modular arithmetic (e.g., additions and/or multiplications) to be implemented particularly efficiently, e.g., using native instructions of the CPU.
  • the NTT can be used with such q.
  • the NTT polynomial is equal to X M - 1 for an integer M.
  • M can be a power of two, or a product of powers of two and/or powers of three, for example.
  • efficient number-theoretic transforms are known.
  • the quotient polynomial p(X) may be a cyclotomic polynomial unequal to X N + 1, but it is also possible to use a quotient polynomial that is not equal to a cyclotomic polynomial.
  • the degree N of the quotient polynomial is strictly larger than half the degree of the NTT polynomial M.
  • the ciphertext to which the blind rotation is applied is typically defined modulo the degree M of the NTT polynomial, e.g., plaintexts may take M possible values.
  • the ciphertext may be obtained by a blind rotation in which an input ciphertext is scaled to the degree M of the NTT polynomial.
  • a proportion of plaintexts larger than one half can be programmed by the blind rotation.
  • quotient polynomial X N ⁇ X N /2 + 1 e.g., where N is two times a power of three or four times a power of three
  • the blind rotation and programmable bootstrapping may work on a wider range of input ciphertexts. For example, additional operations in the encrypted computation needed to ensure that the most significant bit of the input plaintext is not set, may be avoided, thus making the encrypted computation more efficient.
  • the degree of the NTT polynomial is a product of powers of two and/or powers of three.
  • the number-theoretic transform is particularly efficient, making it particularly advantageous to use it.
  • the degree of the NTT polynomial can be a power of two. This is particularly efficient.
  • the modulus q is prime, and the degree M of the NTT polynomial divides the modulus minus one.
  • the field of integers modulo q contains a primitive Mth root of unity, allowing particularly efficient NTT techniques such as the discrete Fourier transform to be used.
  • the quotient polynomial is equal to X N + X N /2 + 1 or X N - X N /2 + 1.
  • this choice of quotient polynomial is advantageous since it allows a relatively large proportion of plaintext values to be programmed.
  • each coefficient of the test polynomial may be computed from at most two desired output values, in particular as a sum where the two desired output values are possibly negated.
  • the desired output value can be efficiently programmed at an arbitrary fixed coefficient, e.g., the coefficient can be different from the leading and constant coefficients. This can be beneficial for further operations of the encrypted computation in which further operations are applied to the encrypted polynomial resulting from the blind rotation prior to extracting the coefficient.
  • the test polynomial may be determined based on a lookup table defining desired output values for respective plaintext values.
  • the inventors realized that, given the modulus, quotient polynomial p(X), and NTT polynomial, it is in general possible to determine a suitable test polynomial for a given lookup table.
  • the inventors realized that, for a quotient polynomial p(X) that divides X M - 1 for an M, the inverse X -1 of the polynomial X exists in R[X] / (p(X)) and can be expressed as a polynomial of degree ⁇ N with coefficients in R.
  • the fixed coefficient is the constant coefficient or the leading coefficient.
  • the ciphertext to which the blind rotation is applied may be an LWE-type ciphertext.
  • the blind rotation may be part of an encrypted computation being carried out on LWE-type ciphertexts (e.g., without involving any NTRU-type ciphertexts).
  • the LWE-type ciphertext may be obtained by conversion from an NTRU-type ciphertext, e.g., as part of an encrypted computation that is carried out on NTRU-type ciphertexts. It is also possible to apply the blind rotation directly to a NTRU-type ciphertext without conversion to LWE.
  • the ciphertext may be a lattice-type ciphertext whose security depends on the cryptographic hardness of a lattice problem, of which LWE and NTRU are two examples.
  • performing the blind rotation may comprise computing one or more external products of ciphertexts with gadget ciphertexts.
  • a gadget ciphertext may comprise multiple constituent ciphertexts, defined based on a gadget matrix.
  • the gadget ciphertext may be a GGSW-type ciphertext.
  • gadget encryption is also referred to as NGS encryption, or as gadget NTRU.
  • the gadget ciphertexts may be comprised in the bootstrapping key, e.g., may represent digits such as bits of a decryption key for decrypting the ciphertext to which the blind rotation is applied.
  • the encrypted computation method may comprise performing a programmable bootstrapping.
  • a modulus switching may be applied to an input ciphertext to obtain a further ciphertext, e.g., an LWE-type ciphertext. As known per se, this may involve scaling the input ciphertext to the degree of the NTT polynomial.
  • the blind rotation may be performed on this further ciphertext.
  • the blind rotation may be followed by a sample extraction in which an encryption of the fixed coefficient is extracted from the polynomial product computed by the blind rotation.
  • the sample extraction may optionally be followed by a key switching.
  • the encrypted computation method may be a "TFHE-like" encrypted computation method, of which the programmable bootstrapping is a core operation. Improving the blind rotation that this involves provides an important efficiency improvement in this setting.
  • additional operations are possible between each of the steps of the programmable bootstrapping, e.g., several modulus-switched ciphertexts may be added together; the outputs of several blind rotations may be added prior to performing the sample extraction; etc.
  • Various such operations may involve polynomial multiplications, e.g., modulo the quotient polynomial or modulo other polynomials that divide the NTT polynomial.
  • the output of the blind rotation may comprise polynomials modulo the quotient polynomial to which additional polynomial multiplications may be applied prior to performing the sample extraction.
  • using the blind rotation as described herein also allows the NTT to be used for such additional polynomial multiplications, further improving the efficiency of the programmable bootstrapping.
  • polynomials of the bootstrapping key when performing the blind rotation using the number-theoretic transform, may be used that are obtained not in a coefficient representation, but in a Fourier-domain representation of the number-theoretic transform.
  • the blind rotation then does not include transforming these polynomials of the bootstrapping key from the coefficient representation to the Fourier-domain representation.
  • the polynomials may be received from another party or accessed from a storage in the Fourier-domain representation. This makes the blind rotation particularly efficient, since the transformation can be done beforehand. Since the bootstrapping key is typically generated once and then used many times, it is much more efficient to determine its Fourier-domain representation when generating it than when using it.
  • the encrypted computation may be a "TFHE-like" encrypted computation.
  • TFHE-like encrypted computation is characterized by the use of a programmable bootstrapping operation, in which an encrypted polynomial product is computed of a bootstrapping monomial representing the plaintext value as an exponent, and a test polynomial.
  • the programmable bootstrapping may involve evaluating a decryption of a ciphertext in an exponent of an encrypted monomial. This evaluation may be computed using an external product with a gadget ciphertext of a bootstrapping key, e.g., a GGSW-type ciphertext, a NGS ciphertext, or a gadget NTRU ciphertext.
  • Such a gadget ciphertext may comprise multiple constituent ciphertexts (e.g., GLWE-like ciphertext in the case of GGSW), and the computation of the external product may involve multiplying the respective constituent ciphertexts of the gadget ciphertext by respective polynomials.
  • This programmable bootstrapping is made more efficient and/or more flexible in terms of accepted input plaintexts as described herein.
  • Medical data may comprise a medical image.
  • a medical image may comprise, e.g., multi-dimensional image data, e.g., to two-dimensional (2D), three-dimensional (3D) or four-dimensional (4D) images, acquired by various acquisition modalities such as, but not limited to, standard X-ray Imaging, Computed Tomography (CT), Magnetic Resonance Imaging (MRI), Ultrasound (US), Positron Emission Tomography (PET), Single Photon Emission Computed Tomography (SPECT), and Nuclear Medicine (NM).
  • CT Computed Tomography
  • MRI Magnetic Resonance Imaging
  • US Ultrasound
  • PET Positron Emission Tomography
  • SPECT Single Photon Emission Computed Tomography
  • NM Nuclear Medicine
  • the provided techniques may be used to evaluate a neural network on encrypted inputs.
  • the party evaluating the neural network may or may not have plaintext access to the trained parameters of the neural network, e.g., weights and biases.
  • the techniques provided herein e.g., the improved polynomial multiplication, programmable bootstrapping, and external product, improve the efficiency of evaluating the neural network and/or reduce storage and transmission requirements for the used ciphertexts or key material.
  • An embodiment of the method may be implemented on a computer as a computer implemented method, or in dedicated hardware, or in a combination of both.
  • Executable code for an embodiment of the method may be stored on a computer program product.
  • Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc.
  • the computer program product comprises non-transitory program code stored on a computer readable medium for performing an embodiment of the method when said program product is executed on a computer.
  • the computer program comprises computer program code adapted to perform all or part of the steps of an embodiment of the method when the computer program is run on a computer.
  • the computer program is embodied on a computer readable medium.
  • LWE Learning With Errors
  • a programmable bootstrapping may obtain an LWE-type input ciphertext encrypting a plaintext value as input and output an LWE-type output ciphertext encrypting a desired output value for the plaintext.
  • An LWE-type ciphertext may comprise one or more mask values and a body value which is derived from the mask values and the plaintext value.
  • the LWE-type input and output ciphertext may be defined modulo a modulus q.
  • the values of an LWE-type ciphertext may be regarded as elements of the discretized torus q ⁇ 1 Z / Z , or equivalently, as integers modulo q.
  • denotes the binary set B 0,1 .
  • the secret key does not necessarily need to contain bits, e.g., see European patent application EP21290025 .
  • the LWE-type ciphertext to which the blind rotation is applied as described herein is typically defined modulo a modulus M that is equal to the degree of the NTT polynomial that is used in the blind rotation.
  • this ciphertext may be obtained by performing a modulus switching to scale an LWE-type input ciphertext modulo a further modulus q (e.g., corresponding to the modulus of the coefficients of the polynomials used in the blind rotation) to this modulus M.
  • a GLWE-type ciphertext may comprise one or more mask polynomials, and a body polynomial which is derived from the mask polynomials and a plaintext polynomial.
  • Another example of a GLWE-type ciphertext is a Ring Learning With Errors (RLWE)-type ciphertext.
  • RLWE-type ciphertext comprises only one mask polynomial.
  • the ciphertext to which the blind rotation is applied, and/or the encrypted polynomial product that results from it may be NTRU ciphertexts.
  • an NTRU ciphertext may comprise only a single polynomial. Security of such ciphertexts may be based on the NTRU assumption.
  • NTRU may be used in combination with the provided techniques by using a blind rotation that results in an NTRU-encrypted polynomial product of a test polynomial and a bootstrapping monomial, and/or by applying a blind rotation to an NTRU ciphertext as input.
  • suitable NTRU encryptions are defined in C. Bonte et al., "FINAL: Faster FHE instantiated with NTRU and LWE", https://ia.cr/2022/074 ; and K. Kluczniak, "NTRU-v-um: Secure Fully Homomorphic Encryption from NTRU with Small Modulus", https://ia.cr/2022/089 .
  • a gadget ciphertext may be defined as a ciphertext that comprises multiple constituent ciphertexts encrypting respective values based on a plaintext, and which may be defined based on a gadget matrix.
  • the gadget ciphertext can be a GGSW-type ciphertext as defined e.g. in the "Programmable bootstrapping enables " .
  • as gadget encryption can for example be used: the NGS encryption of C.
  • (G)LWE/NTRU/... ciphertexts according to a symmetric encryption scheme (e.g., one secret key is used both for encryption and decryption), but it is also possible for the used ciphertexts to be according to asymmetric encryption scheme (e.g., different public and private keys are used for encryption and decryption, respectively).
  • the above secret key may be used as the private key, wherein the public key comprises one or more encryptions of zero, e.g., see R. Rothblum, "Homomorphic encryption: From private-key to public-key", Theory of Cryptography (TCC 2011), vol. 6597 of Lecture Notes in Computer Science, pp. 219-234, Springer, 2011 .
  • Various embodiments use the number-theoretic transform to perform polynomial multiplications modulo a modulus q and a quotient polynomial p(X) that divides an NTT polynomial.
  • the NTT polynomial is equal to X M -1 and the quotient polynomial divides the NTT polynomial, e.g., trivially divides it by being equal, or strictly divides it.
  • the modulus q may be selected such that M is a unit in Z / qZ , preferably, such that 2/q2 comprises a primitive root of unity of order M.
  • polynomial multiplication in the Fourier domain of the number-theoretic domain can be implemented particularly efficiently, e.g., as a pointwise multiplication of evaluations of the multiplicands in powers of the primitive root of unity.
  • Techniques for this are known per se, e.g. from J. von Kunststoff Gathen and J. Gerhard, "Modern Computer Algebra", Cambridge University Press, 3rd edition, 2013 .
  • the term "primitive root of unity" is used throughout this specification as defined in this reference.
  • the quotient polynomial may be any quotient polynomial p(X) dividing X M - 1, and the Fourier representation of a polynomial may be defined as a set of evaluations of the polynomial in a set of powers of the primitive Mth root of unity.
  • the Fourier representations may be multiplied by pointwise multiplication of the evaluations in the respective powers of the primitive Mth root of unity.
  • M contains one or more powers of two and/or one or more powers of three, e.g., M is a power of two or M is a power of three.
  • To multiply the polynomials only the evaluations for this subset of powers of the root of unity suffice, leading to a more efficient polynomial multiplication. Still, an efficient number-theoretic transform and inverse are possible.
  • the described techniques relate to a blind rotation using a bootstrapping key.
  • Encrypted computation techniques supporting such a blind rotation may be referred to as "TFHE-like" homomorphic encryption schemes.
  • TFHE-like schemes make them an appealing choice for a wide range of applications. Because bootstrapping is relatively efficient compared to many other FHE schemes, it is much more feasible to perform relatively complex computations, e.g., with a multiplicative depth of at least 10, at least 50, or at least 100.
  • the cryptographic parameters of TFHE-like schemes can be selected based on the required precision and resulting computational cost, independently from the quantity of homomorphic operations and their circuit depth.
  • bootstrapping can be so inefficient that, in practice, these schemes are typically applied in a levelled way, meaning that their parameters are selected depending on a given computation such that it can be performed without the need for bootstrapping. Such a levelled approach is not feasible for more complex computations, however, so in such cases, TFHE-like schemes are particularly beneficial.
  • n kN, where N is the degree of the quotient polynomial, k is the number of random mask polynomials of a ciphertext, and n is the length of the secret key; q, the modulus; and ⁇ , the statistical parameter of the noise, e.g., its standard deviation.
  • the security is based on the distribution of the secret key, and on two main parameters: N, the degree of the quotient polynomial; and ⁇ , the statistical parameter of the noise,
  • the parameters of TFHE-like (e.g., LWE/GLWE) ciphertexts that are used may be selected based on a desired security level and based on a desired accuracy of operations such as linear combination of ciphertexts and/or applying a programmable bootstrapping, in other words, a noise level resulting from applying these operations.
  • security parameters may be selected independently of the computational complexity, e.g. independently of the multiplicative depth of the computation. This is unlike for non-TFHE-like schemes, where the security parameters are typically chosen to limit or eliminate bootstrappings.
  • LWE-based ciphertexts and/or GLWE-based ciphertexts used in the TFHE setting herein may use a relatively small modulus, e.g., of at most 32 bits, at most 64 bits, or at most 128 bits. This modulus is typically selected independent from the computation to be carried out, e.g., it is selected depending on a desired precision and/or efficiency.
  • Parameters N, k, and/or ⁇ may be selected to achieve a desired security level, also typically independently from the computation to be carried out. For example, N may be set to at least 512 and/or at most 2048 or 4096, e.g., to 1024.
  • N is not typically used in non-TFHE-like encryption schemes, where such values would severely restrict the computations that can be performed; instead, in non-TFHE-like schemes, q and N are typically both selected based on the desired security level, such that q may be much larger.
  • Fig. 1a schematically shows an example of an embodiment of an encrypted computation device 110.
  • Device 110 may comprise a processor system 130, a storage 140, and a communication interface 150.
  • Storage 140 may comprise local storage, e.g., a local hard drive or electronic memory.
  • Storage 140 may comprise non-local storage, e.g., cloud storage. In the latter case, storage 140 may comprise a storage interface to the non-local storage.
  • storage 140 may be for storing an LWE-type ciphertext on which to perform a programmable bootstrapping or a blind rotation.
  • Storage 140 may further be for storing a bootstrapping key for use in a blind rotation.
  • the blind rotation may use the bootstrapping key to perform LWE decryption in an exponent of a bootstrapping monomial.
  • the bootstrapping key may be stored in a Fourier domain representation of the number-theoretic transform used in the blind rotation, improving its efficiency.
  • NTRU can be used, for example.
  • Device 110 may communicate internally, with other devices, external storage, input devices, output devices, and/or one or more sensors over a computer network.
  • the computer network may be an internet, an intranet, a LAN, a WLAN, etc.
  • the computer network may be the Internet.
  • the device may optionally comprise connection interface 150 which is arranged to communicate with other devices as needed.
  • the connection interface may comprise a connector, e.g., a wired connector, e.g., an Ethernet connector, an optical connector, etc., or a wireless connector, e.g., an antenna, e.g., a Wi-Fi, 4G or 5G antenna.
  • Communication e.g., internal communication, may use other communication protocols or media, e.g., an internal data bus.
  • the communication interface 150 may be used to send or receive digital data.
  • device 110 may be configured to receive or send data representing an LWE-type ciphertext, e.g., an input to the blind rotation or programmable bootstrapping, or its output.
  • the communication interface 150 may be further used to receive data representing the bootstrapping key.
  • the bootstrapping key may be received in a Fourier domain representation of the NTT used in the blind rotation.
  • the execution of device 110 may be implemented in a processor system 130, e.g., one or more processor circuits, e.g., microprocessors, examples of which are shown herein.
  • Device 110 may comprise multiple processors, which may be distributed over different locations. For example, device 110 may use cloud computing.
  • Processor system 130 may be configured to obtain an LWE-type ciphertext encrypting a plaintext value, e.g., to receive it or to compute it by performing an encrypted computation.
  • Processor system 130 may be configured to perform a blind rotation of the LWE-type ciphertext according to a test polynomial.
  • the blind rotation may result in an encrypted polynomial product of the test polynomial and a bootstrapping monomial modulo a modulus and modulo a quotient polynomial.
  • the bootstrapping monomial may represent the plaintext value as an exponent.
  • the quotient polynomial may divide an NTT polynomial that allows a number-theoretic transform modulo the modulus.
  • Processor subsystem 130 may be configured to perform a polynomial multiplication of the blind rotation using the number-theoretic transform.
  • the test polynomial may be defined such that the polynomial product has a desired output value for the plaintext value as a fixed coefficient.
  • Processor system 130 may be further configured to output the computed encrypted polynomial product, e.g., for use in the encrypted computation.
  • processor system 130 may compute an LWE encryption representing an output of the encrypted computation based on the computed encrypted polynomial product, and output the LWE encryption e.g. by storing it on storage 130 and/or sending it to another party via communication interface 150.
  • NTRU can be used, for example.
  • FIG. 1 Some of the figures show functional units that may be functional units of the processor system. For example, a figure may be used as a blueprint of a possible functional organization of the processor system.
  • the processor circuit(s) are not shown separate from the units in most figures.
  • the functional units shown in figures 2 and 3 may be wholly or partially implemented in computer instructions that are stored at a device such as device 110, e.g., in an electronic memory of device 110, and are executable by a microprocessor of device 110.
  • functional units are implemented partially in hardware, e.g., as coprocessors, e.g., arithmetic and/or cryptographic coprocessors, and partially in software stored and executed on device 110.
  • device 110 may be a device for performing an encrypted computation.
  • the encrypted computation may use homomorphic encryption cryptography.
  • the device 110 may be used to perform an encrypted computation, e.g., the device may perform the computation even though said data is received in encrypted form, e.g., from a data provider, and even though the device 110 is not able to decrypt the data.
  • the computation may involve the blind rotation as described herein, for example, as part of a programmable bootstrapping.
  • storage 140 may store encrypted data items, e.g., received from one or more data providers or generated as intermediate results or end results, e.g., outputs, of the computation.
  • encrypted data items e.g., received from one or more data providers or generated as intermediate results or end results, e.g., outputs, of the computation.
  • most or all data items on which the computation of device 110 is performed are encrypted with a key (or keys) that is not known to device 110-that is device 110 may not be configured to obtain the plain data items corresponding to the encrypted data items, e.g., such as stored in storage 140.
  • the decryption key in plain form is secret for device 110, though the encryption/decryption key may be available in encrypted form.
  • the processor system may be configured to perform a sequence of homomorphic encryption operations, which may include arithmetic operations on encrypted values such as addition and multiplication, and which may further include one or more blind rotations, e.g., as part of respective programmable bootstrapping operations.
  • homomorphic encryption operations may include arithmetic operations on encrypted values such as addition and multiplication, and which may further include one or more blind rotations, e.g., as part of respective programmable bootstrapping operations.
  • Fig. 1b schematically shows an example of an embodiment of a device 119 for determining a test polynomial for use in an encrypted computation, e.g., for use by device 110 of Fig. 1a .
  • the encrypted computation may comprise computing a polynomial product of a bootstrapping monomial and a test polynomial modulo a modulus and modulo a quotient polynomial, with the quotient polynomial dividing an NTT polynomial.
  • Device 119 may perform the encrypted computation itself, e.g., device 110 of Fig. 1a may be combined with device 119 of Fig. 1b .
  • Device 110 may comprise a processor system 139, a storage 149, and a communication interface 159.
  • Processor system 139, storage 149, and communication interface 159 may be implemented as discussed for the respective components of Fig. 1a .
  • Storage 149 may be for storing a lookup table defining desired output values for respective plaintext values.
  • the lookup table can be stored for example by storing respective output values, respective pairs of input values, or another representation of a function mapping inputs to outputs, e.g., a symbolic or executable representation.
  • Communication interface 159 may be used to receive the lookup table and/or one or more system parameters such as the modulus, the quotient polynomial and the NTT polynomial. Communication interface 159 may be used to send the computed test polynomial.
  • Processor system 139 may be configured to obtain the modulus, the quotient polynomial, and the NTT polynomial. Processor system 139 may be further configured to compute the test polynomial such that the polynomial product has the respective desired output values as a fixed coefficient for the respective plaintext values.
  • Fig. 1c schematically shows an example of an embodiment of an encrypted computation system 100.
  • System 100 is configured for performing an encrypted computation using homomorphic encryption, e.g., fully homomorphic encryption.
  • the system 100 in this example comprises a key generation device 111, a data provider device 113 and an encrypted computing device 112.
  • Key generation device 111 and data provider device 113 may be combined in a single device.
  • Device 112 may be configured to receive encrypted data items from a data provider 113. At least one or more data items may be received in encrypted form. One or more further data items may be received in plain format.
  • the computation is run on the received data items and possibly also on stored data items. Interestingly, the computation may be performed on the encrypted data, without decrypting the data, e.g., without converting encrypted data items to data in a plain format.
  • Device 112 in this example may be based on device 110 of Fig. 1a , e.g., may comprise processor system 130, storage 140, and/or communication interface 150 of Fig. 1a .
  • Each of the devices 111, 112, 113 may be based on device 119 of Fig. 1b , e.g., may each comprise processor system 139, storage 149, and/or communication interface 159 of Fig. 1b .
  • device 111 comprises a key generation unit 131, e.g., implemented by a processor system of the device 111.
  • Key generation unit 131 is configured to generate a bootstrapping key 151 for use by encrypted computing device 112.
  • the bootstrapping key may allow to perform a blind rotation, as described herein.
  • Device 111 may provide the bootstrapping key 151 to device 112, e.g., send it via computer network 150, upload it to a shared storage, etc.
  • Device 111 may provide polynomials of the bootstrapping key in a Fourier domain representation of a number-theoretic transform.
  • device 112 comprises an encrypted computation unit 132, e.g., implemented by a processor system of the device 112.
  • Encrypted computation unit 132 may be configured to carry out the encrypted computation.
  • the encrypted computation may involve a blind rotation of an e.g. LWE-type ciphertext e.g. as described for device 110 of Fig. 1a .
  • the encrypted computation unit 132 may use the bootstrapping key 151 that it has obtained from device 111, e.g., received via network 150 or retrieved from a shared storage.
  • the blind rotation may use a test polynomial.
  • the test polynomial may be determined from a lookup table by device 111, device 112, or device 113, e.g., as described for device 119 of Fig. 1b .
  • the encrypted computation may comprise many other operations, as known per se, e.g., device 112 may be configured to evaluate an arithmetic circuit, to evaluate a neural network on encrypted data, etc.
  • the encrypted computation system 100 may comprise multiple encrypted computing devices, e.g., two, three or more than three.
  • the encrypted computation may be distributed among the multiple encrypted computing devices.
  • the encrypted computing devices may exchange intermediate computation results, typically encrypted, among each other.
  • Each encrypted multiplication device may be implemented like encrypted computing device 112, and may perform multiplications of ciphertexts by polynomials as described herein.
  • Homomorphic encryption schemes can be applied in many settings.
  • encrypted computing device 112 may be operated by a cloud provider.
  • the cloud provider may offer computation and storage services to its clients.
  • data provider device 113 e.g., a client of the cloud provider, can send their data in encrypted form.
  • the cloud provider can still perform the required computations, and/or the required storage, but is not able to know the corresponding to plain data.
  • data provider device 113 may use an encryption key of a type corresponding to the particular homomorphic encryption system used to encrypt the data items.
  • a corresponding decryption key may be used to decrypt the encrypted data items. Encryption and decryption keys may be the same-and typically are so.
  • encrypted computation system 100 may be configured to train machine-learning models, e.g., image classifiers, e.g., medical models, without the encrypted computing devices having access to the plain data items. For example, linear regression may be performed on the input data, possibly, even without bootstrapping. For example, back-propagation may be performed on the input data, possibly, with bootstrapping.
  • the resulting model parameters may be returned to an entity who is in possession of the decryption key. This enables multiple providers of medical data to pool their data, by sending the data to a cloud provider. The cloud provider then returns the model parameters, without ever having access to the plain data.
  • Encryption keys may be equal to decryption keys.
  • the encrypted computation system 100 may be used to offer the model, say, for use with medical data. This can be done with plain model parameters or encrypted model parameters-in both cases with encrypted data, e.g., encrypted input, intermediate and output data. Using plain model parameters is usually much more efficient. In both cases, an effect of the system is that a computation is performed, say an image classification, e.g., a medical image classification, without the computer knowing the plain data items. For example, a mammogram may be evaluated for cancer, without the image ever being in the plain at an encrypted computing device 112 and without any encrypted computing device 112, or a coalition of such devices, knowing what the outcome of the cancer evaluation is. From a privacy point of view it may be acceptable to operate a plain model on encrypted privacy sensitive data, while it might not be acceptable to operate on plain privacy sensitive data.
  • system 100 may be used for protected control of a device.
  • a device even a large device such as a power plant, may send sensor values to an encrypted computing device 112, and receive encrypted control signals in return. The control signals being computed from the sensor signals.
  • An attacker of the system may be able to determine the contents of data going to and from one or more encrypted computing devices 112, or even gain access to intermediate data of these devices, but he will not be helped by that as the data is encrypted. Even a full break of all encrypted computing devices 112 of a system 100 will not reveal the data, as the decryption key is not known to these devices.
  • Computing the control signal may involve such mathematical operations as linear algebra, averages, matrix multiplication, polynomial evaluations, and so on, all of which are possible to execute with homomorphic encryption operations.
  • a pool of encrypted data items may be maintained in the encrypted computation system; a subset of these may be received and another subset may be the result of an encrypted computation, e.g., intermediate results.
  • an encrypted computing device 112 may be configured to apply a homomorphic encryption operation to one, two or more encrypted data items in a pool, e.g., a collection of input and/or intermediate and/or output values.
  • the result may be a new encrypted data item that may be stored in the pool.
  • the pool may be stored in a storage of the encrypted computation system. This may be local storage or a distributed storage. In the latter case, it may happen that one or more encrypted data items are represented multiple times in the pool. Encrypted data items may be sent from one computing device to another, e.g., if their values are needed elsewhere.
  • the pool may be implemented in various ways, e.g., as a register file, an array, various data structure, and so on.
  • the encrypted data items may represent all kinds of data.
  • encrypted data items may represent numbers that need to be averaged, or which are used for linear regression, etc.
  • the encrypted data items may represent an image.
  • each pixel of the image may correspond to one or more encrypted data items.
  • a grey-scale pixel may be represented by a grey level, which in turn may be represented by a single encrypted data item.
  • 256 grey levels may be encoded in a single encrypted data item.
  • a colour pixel may be represented as multiple colour levels, e.g., RGB levels, which in turn may be represented by a tuple of encrypted data items.
  • three 256-level colours may be encoded in three encrypted data items.
  • how many encrypted data items are used to represent some type of data depends on the capacity of the homomorphic encryption scheme. For example, more restrictive homomorphic encryption schemes may only be capable of encoding one bit per encrypted data item. In that case, one colour pixel, may require 24 encrypted data items.
  • a set of homomorphic encryption operations may be defined for the computation.
  • a network or circuit of operations may be built that together implement the computation, e.g., by an external compiler device or by the computation device itself.
  • the operations may include Boolean operations.
  • the computation may be represented as a list of homomorphic encryption operations that are to be performed together with an indication on which encrypted data item they are to be performed.
  • the network or circuit may indicate to the encrypted computation device 112 when to carry out a blind rotation and/or programmable bootstrapping and may include the test polynomial or a lookup table from which the test polynomial can be computed as described herein.
  • Fig. 2 schematically shows an example of an embodiment of a programmable bootstrapping unit 200.
  • an LWE-type input ciphertext 210 comprising a number n of mask values a i and a body value b .
  • the values are defined modulo a modulus q.
  • Input ciphertext 210 may be denoted as c ⁇ LWE s ⁇ ⁇ Z / qZ n + 1 .
  • an input LWE ciphertext may be obtained by converting from an NTRU ciphertext. In other cases, no such conversion may be performed, e.g., the input LWE ciphertext can be computed based on an LWE-encrypted output of a programmable bootstrapping, without any NTRU encryption being used in this computation.
  • Modulus switching unit may be configured to perform a modulus switching on the input ciphertext 210 to obtain an LWE-type ciphertext 211. This may comprise scaling respective values of the input ciphertext 210 to the degree M of the NTT polynomial discussed below, e.g., by scaling by a factor M / q and then rounding.
  • the modulus switching may be implemented as disclosed in the reference "Programmable bootstrapping enables ".
  • Units 240 and 260 may together be configured to perform a blind rotation of the LWE-type ciphertext 211.
  • Units 240 and 260 may use GLWE encryptions modulo a modulus q and modulo a quotient polynomial p(X).
  • the modulus q is the same as for LWE-type input ciphertext, but in principle this is not needed.
  • the quotient polynomial p(X) may divide an NTT polynomial, e.g., X M - 1, that allows a number-theoretic transform modulo the modulus q.
  • q may be a power of two, in which case a quotient polynomial different from X N + 1 may be used. Further examples are provided below.
  • the blind rotation may use a bootstrapping key 270.
  • the bootstrapping key 270 may allow to perform a blind rotation of the LWE-type ciphertext 211.
  • the blind rotation may further use a test polynomial v, 230.
  • the quotient polynomial may be unequal to X N + 1 as is used in the prior art, so that it is no longer possible to use a test polynomial that has respective desired output values as its respective coefficients.
  • the test polynomial may be defined in such a way that the polynomial product X - ⁇ * ⁇ v , modulo the modulus q and the quotient polynomial p(X), has desired output values for respective plaintext values as a fixed coefficient.
  • the test polynomial v, 230 may be programmed as a look-up table so that X - ⁇ * ⁇ v, up to drift, encodes f ( ⁇ ) for a chosen function f.
  • the blind rotation may convert the scaled version 211 of the input ciphertext c ⁇ LWE s ⁇ ⁇ Z / qZ n + 1 into an encrypted polynomial product 250 of the bootstrapping monomial X - ⁇ * and the test polynomial v, 230 modulo the modulus q and modulo the quotient polynomial p(X).
  • the blind rotation may be computed by performing a sequence of respective accumulation operations 260 with respect to GGSW encryptions GGSW ( s i ) of the bootstrapping key 270 encrypting respective bits of the decryption key for the input ciphertext.
  • the accumulation operation may selectively add a current random mask value of the LWE-type ciphertext 211 to a current GLWE encryption 250 depending on whether the bit of the bootstrapping key is set.
  • blind rotation may be implemented as follows:
  • this algorithm indeed results in a GLWE encryption 250 of X - ⁇ * ⁇ v under key s'.
  • This example uses n bootstrapping keys 270, bsk[ j ] ⁇ GGSW s , ( s j ) for 1 ⁇ j ⁇ n .
  • an initialization 240 is used that initially sets the GLWE encryption to an encryption of X - b ⁇ ⁇ v.
  • the accumulation unit 260 may compute an external product of a GLWE-type ciphertext 250 with a GGSW-type ciphertext 270, where computing the external product comprises performing polynomial multiplications. As shown in the figure, these polynomial multiplications may be performed more efficiently by computing them using a modular multiplication unit 261 that performs the polynomial multiplications using the number-theoretic transform.
  • This example uses a series of accumulation operations 260 with respect to a bootstrapping key 270 comprising GGSW encryptions of bits of the secret key, where the accumulation operation uses an external product.
  • the provided techniques readily generalize to other variants of the blind rotation.
  • any blind rotation that comprises computing an external product with GGSW encryptions of the bootstrapping key can be improved, for example, the blind rotation where bootstrapping key 270 contains non-binary digits as disclosed in European patent application EP21290025 , or a blind rotation that processes multiple key digits concurrently.
  • performance may be improved. More generally, any polynomial multiplication performed as part of the blind rotation can be made more efficient by using the number-theoretic transform.
  • Sample extraction unit 280 may be configured to take as input the GLWE-encrypted polynomial product 250 having the desired output value as a fixed coefficient, and to perform a sample extraction to extract an LWE encryption 290 of this fixed coefficient from the encryption 250.
  • the sample extraction may be as known from the reference "Programmable bootstrapping enables .".
  • test polynomial 230 v is defined such that the encrypted polynomial product 250 has the desired output value as a coefficient.
  • the inventors realized that it is possible to "program" the test polynomial to have this property for any quotient polynomial p(X) that divides NTT polynomial X M - 1.
  • test polynomial v ⁇ R [ X ]/( p ( X )), 230 may be defined such that X - ⁇ * ⁇ v encodes the desired output value for the plaintext ⁇ * of ciphertext 211, and accordingly, up to drift, encodes f ( ⁇ ) for a chosen function t where ⁇ is the plaintext of ciphertext 210.
  • the value f ( ⁇ ) may be encoded as the constant coefficient of X - ⁇ * ⁇ v.
  • R be a ring with identity.
  • p X X N + p N ⁇ 1 X N ⁇ 1 + p N ⁇ 2 X N ⁇ 2 + ⁇ + p 0 defined over R, and such that p(X) divides an NTT polynomial X M - 1 for a certain given M.
  • X -1 exists in R[X] / (p(X)) if the quotient polynomial p(X) divides the NTT polynomial X M -1 for an M.
  • X -1 can be expressed as a polynomial of degree ⁇ N with coefficients in R.
  • a multiplication with X -1 may lead to adding a scaled version of the constant term of v(X) to the other coefficients, where the scaling depends on the index of the coefficient, and a shift.
  • test polynomial 230 can be computed.
  • Preferred embodiments include embedding a set of values either in the constant or in the leading coefficients of X -t v(X). In these examples, the inventors were able to derive expressions for the test polynomial that are particularly efficient to determine.
  • Example test polynomial 1 fixed coefficient is constant coefficient
  • test polynomial For example, the following algorithm may be used to compute the test polynomial:
  • Example test polynomial 2 fixed coefficient is leading coefficient
  • Example test polynomial 3 quotient polynomial is X N ⁇ X N /2 + 1
  • p i 0 for all i e ⁇ 0, ..., N ⁇ 0, N /2, N ⁇ .
  • test polynomial 230 the following algorithm may be used to determine the test polynomial 230:
  • Example test polynomial 4 Other quotient polynomials/coefficients
  • example 3 In general, in order to determine the test polynomial for other quotient polynomials, the approach of example 3 may be followed by writing out the explicit formulas for (( X -t v ( X ))) s for each value of t and solving the resulting system. This approach is preferred for sparse quotient polynomials, e.g., with at most 3, at most 5, or at most 10 nonzero coefficients.
  • test polynomial Another way to determine the test polynomial is to view the multiplication of a polynomial v(X) by X -1 in R[X] / (p(X)) as a maxtrix multiplication with the coefficient vector of v(X). This results in a system of N linear equations and N variables that can be solved using techniques that are known per se, with the solution corresponding to the coefficients of the test polynomial. The system in many cases is solvable; if not, for example, a next fixed coefficient can be selected to determine a test polynomial for.
  • the degree of the NTT polynomial M may be selected to be a power of three.
  • the values of K may be programmed in the constant coefficient of X -t v(X) as fixed coefficient.
  • the regular number-theoretic transform may be used, e.g., as described in "Modern Computer Algebra" and as also discussed in more detail elsewhere in this specification.
  • the regular number-theoretic transform can be applied if the modulus q is selected such that 2/q2 contains a primitive M-th root of unity.
  • One way of ensuring this is by setting q to be a prime such that M divides q - 1.
  • the regular NTT cannot be applied directly as number-theoretic transform in this case, since Z/gZ does not contain a primitive M-th root of unity. (Specifically, Z/qZ cannot contain an element of order M, since for this M needs to divide the order of the group of units of Z/qZ, which is q/2 if q is a power of two.)
  • other number-theoretic transforms can be applied in this setting, for example, Schönhage's algorithm or Nussbaumer's algorithm can be used. The same is true for other choices of M such that M is a unit in 2/q2.
  • Fig. 3 schematically shows an example of an embodiment of an accumulator unit 360, for example for use in the blind rotation of Fig. 2 .
  • Accumulator unit 360 may be configured to perform an accumulation operation that selectively adds a current random mask value 311 of an LWE-type ciphertext to a current GLWE encryption 350, depending on whether a GGSW-encrypted current bit 371 of a bootstrapping key is set.
  • Accumulator unit 360 may be configured to obliviously select either the current GLWE encryption 350, or the current GLWE encryption multiplied by a monomial representing the current random mask value 311, depending on whether the current bit 371 of the bootstrapping key is set.
  • Such an operation that obliviously selects a first or second GLWE ciphertext is also known as a controlled selector gate or controlled multiplexer operation, CMux.
  • a detailed example is given in "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks".
  • the accumulator unit may compute CMux (bsk[ j ], ACC, X ⁇ j ⁇ ACC), where ACC is the current GLWE encryption 350, ⁇ j is the current random mask value 311, and bsk[ j ] is the GGSW-encrypted current bit 371.
  • accumulator unit 360 may compute a GLWE-encrypted difference 363 between the desired output if the bit 371 is set and the desired output if the bit 371 is not set.
  • the difference 363 may be performed by computing a polynomial multiplication ModMul, 362.
  • the polynomial multiplication may multiplying the current GLWE encryption ACC, 350, by a polynomial, e.g., X a j ⁇ ⁇ 1 , 312, derived from the current random mask value 311, e.g., using the notation above, (X ⁇ j - 1) ⁇ ACC may be computed.
  • the polynomial multiplication 362 is typically performed in the coefficient domain representation of the polynomials, not the Fourier domain representation of the number-theoretic transform.
  • the accumulator unit 360 may compute an external product of the difference with the GGSW-encrypted bit 371. This may result in a GLWE encryption 368 that encrypts zero if the encrypted bit 371 is zero and the difference 363 if the bit is one.
  • performing such an external product of a GLWE encryption 363 and a GGSW encryption 371 may comprise computing multiple respective polynomial products.
  • a GGSW encryption 371 of a given plaintext may comprise multiple respective GLWE encryptions of values that depend on the plaintext.
  • computing the external product may comprise computing a gadget decomposition GDec, 364, of the GLWE encryption 363, as known per se.
  • the gadget decomposition may result in a vector 365 of polynomials defined based on the GLWE encryption 363.
  • the gadget decomposition is typically computed on polynomials in coefficient representation.
  • the external product may be computed by multiplying the gadget decomposition vector 365 by the GGSW encryption 371 considered as a matrix of polynomials.
  • the matrix multiplication may be computed modulo the modulus q and the quotient polynomial q(x) as described herein, and may accordingly comprise polynomial multiplications of respective polynomials based on the GLWE encryption 363, and polynomials of the GGSW encryption 371.
  • the gadget decomposition 365 which is typically computed 364 in coefficient representation, may be converted to a Fourier domain representation by applying the number-theoretic transform NTT, 320.
  • the result is the gadget decomposition 366 in the Fourier-domain representation, shown with dashes in the figure.
  • the gadget decomposition 366 may then be multiplied with the GGSW encryption 371, also in Fourier-domain representation, by applying a Fourier-domain polynomial multiplication FFTMul, 330.
  • This multiplication 330 may comprise pointwise multiplying evaluations of the respective polynomials in a set of evaluation points, as also discussed in more detail elsewhere.
  • the result may be the GLWE encryption 367 resulting from the external product, in Fourier-domain representation.
  • the Fourier-domain representation 367 By converting the Fourier-domain representation 367 back using an inverse INTT, 340, of the number-theoretic transform, the GLWE encryption may be obtained in coefficient representation 368.
  • the GGSW encryption 371 may be obtained in Fourier-domain represented form, e.g., may be received from another party or from storage in Fourier domain representation. It is also possible to convert to the Fourier-domain represented form by applying an NTT 320 as part of the accumulation 360, however.
  • R be a ring with unity.
  • ⁇ e be a primitive M-th root of unity for an integer M > 1. It is described how to multiply two polynomials f, g e R [ X ]/( X M - 1) modulo an NTT polynomial X M - 1. This is known per se, e.g., from chapter 8 of "Modern Computer Algebra".
  • DFT ⁇ ⁇ 1 h 1 M DFT ⁇ ⁇ 1 h , for any polynomial h ⁇ R[X] of degree ⁇ M.
  • the polynomial product modulo the quotient polynomial may be obtained by computing h(X) mod q(X).
  • the Fourier-domain representation may comprise only a subset of the set of powers of the primitive M-th root of unity.
  • the number-theoretic transform operation 320 may be implemented as DFT ⁇ ⁇ ⁇ , taking as input a polynomial 365 in R [ X ]/( X N + X N /2 + 1) and returning its Fourier representation 366.
  • M the degree of the NTT polynomial.
  • M the degree of the NTT polynomial.
  • the number-theoretic transform can be implemented using Schönhage's algorithm, e.g., see “Modern Computer Algebra", Algorithm 8.30, or using Nussbaumer's algorithm, e.g., see “Modern Computer Algebra", Exercise 4.6.4.59. Further implementations of the number-theoretic transform are disclosed e.g. in D.
  • the GLWE encryption 368 may be homomorphically added Add, 369, to the current GLWE encryption 350 to obtain GLWE encryption 350' representing the output of the accumulator unit, e.g., ACC ⁇ ACC + bsk j ⁇ X a ⁇ j ⁇ 1 ⁇ ACC , or equivalently, ACC ⁇ CMux (bsk[ j ], ACC, X ⁇ j ⁇ ACC).
  • the role of zero and one in the encryption key 371 can be reversed by appropriately adapting the difference 363 and the value added to the GLWE encryption 368; addition 369 may be performed in the Fourier domain; etcetera.
  • the accumulator unit 360 may compute an external product of a GLWE-type ciphertext with a GGSW-type ciphertext of the bootstrapping key, which may be made more efficient by using the number-theoretic transform for its polynomial multiplications as discussed above.
  • the proposed techniques are explained based on (G)LWE encryption, and its gadget variant GGSW.
  • the ciphertext 211 to which the blind rotation is applied is a LWE ciphertext
  • the encrypted polynomial product 250 of the blind rotation is a GLWE encryption
  • the accumulator is implemented using GGSW encryptions of a bootstrapping key.
  • the bootstrapping key may comprise gadget NTRU encryptions.
  • the provided techniques can be applied to any bind rotation that results in an encrypted polynomial product of a test polynomial and a bootstrapping polynomial modulo a quotient polynomial different from X M + 1, e.g., any accumulator-based blind rotation.
  • NTRU for the encrypted polynomial product 250
  • this accumulator can be implemented based on GLWE, this is not necessary.
  • Other types of accumulators are possible, for example based on NTRU.
  • a gadget encryption analogous to GGSW encryption can be defined and with it, an external product.
  • the accumulator may be implemented based on NTRU, where its value may for example contain an element in Z N , q X and CMux may be defined as discussed with respect to Fig. 3 .
  • applying the blind rotation to an LWE ciphertext c encrypting ⁇ using this type of NTRU-based accumulator may result in an encrypted polynomial product X - ⁇ * ⁇ v of bootstrapping monomial X - ⁇ * and test polynomial v.
  • an LWE ciphertext encrypting the constant term of X - ⁇ * ⁇ v can optionally be extracted from this encrypted polynomial, as discussed in the "FINAL" reference.
  • the input ciphertext 211 need not be an LWE-type ciphertext.
  • a blind rotation can be applied to a NTRU-type ciphertext, as discussed in the "FINAL” reference. It is also possible to obtain an input LWE ciphertext 211 by converting it from a NTRU ciphertext, as discussed in the "FINAL" reference.
  • test polynomial v such that the encrypted polynomial product X - ⁇ * ⁇ v contains a desired output value at a fixed coefficient. Also in the case of NTRU, the provided techniques allow a test polynomial to be defined for various choices of the quotient polynomial different from X M + 1 are used.
  • Fig. 4 schematically shows an example of an embodiment of an encrypted computation method 400.
  • Encrypted computation method 400 may be computed-implemented.
  • the method 400 may comprise obtaining 410 an, e.g. LWE-type, ciphertext encrypting a plaintext value.
  • the method 400 may further comprise performing 420 a blind rotation of the ciphertext according to a test polynomial.
  • the blind rotation may result in an encrypted polynomial product of the test polynomial and a bootstrapping monomial modulo a modulus q and modulo a quotient polynomial p(X).
  • the bootstrapping monomial may represent the plaintext value as an exponent.
  • the quotient polynomial p(X) may divide an NTT polynomial, e.g., X M - 1 that allows a number-theoretic transform modulo the modulus q.
  • Performing the blind rotation may comprise performing 425 a polynomial multiplication using the number-theoretic transform.
  • the test polynomial may be defined such that the polynomial product has a desired output value for the plaintext value as a fixed coefficient.
  • Fig. 5 schematically shows an example of an embodiment of a method 500 of determining a test polynomial.
  • the method 500 may be computer-implemented.
  • the test polynomial may be for use in an encrypted computation as described herein.
  • the encrypted computation method may comprise computing a polynomial product of a bootstrapping monomial and a test polynomial modulo a modulus q and modulo a quotient polynomial p(X).
  • the quotient polynomial p(X) may divide an NTT polynomial.
  • the method 500 may comprise obtaining 510 a lookup table defining desired output values for respective plaintext values.
  • the method 500 may comprise obtaining 520 the modulus, the quotient polynomial, and the NTT polynomial.
  • the method 500 may comprise computing 530 the test polynomial such that the polynomial product has the respective desired output values as a fixed coefficient for the respective plaintext values.
  • Embodiments of the methods may be executed using software, which comprises instructions for causing a processor system to perform method 400 or 500.
  • Software may only include those steps taken by a particular sub-entity of the system.
  • the software may be stored in a suitable storage medium, such as a hard disk, a floppy, a memory, an optical disc, etc.
  • the software may be sent as a signal along a wire, or wireless, or using a data network, e.g., the Internet.
  • the software may be made available for download and/or for remote usage on a server.
  • Embodiments of the method may be executed using a bitstream arranged to configure programmable logic, e.g., a field-programmable gate array (FPGA), to perform the method.
  • FPGA field-programmable gate array
  • the presently disclosed subject matter also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the presently disclosed subject matter into practice.
  • the program may be in the form of source code, object code, a code intermediate source, and object code such as partially compiled form, or in any other form suitable for use in the implementation of an embodiment of the method.
  • An embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the processing steps of at least one of the methods set forth. These instructions may be subdivided into subroutines and/or be stored in one or more files that may be linked statically or dynamically.
  • Another embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the devices, units and/or parts of at least one of the systems and/or products set forth.
  • the devices described herein comprise one or more microprocessors which executes appropriate software stored at the system; for example, that software may have been downloaded and/or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash.
  • the systems may, in whole or in part, be implemented in programmable logic, e.g., as field-programmable gate array (FPGA).
  • FPGA field-programmable gate array
  • the systems may be implemented, in whole or in part, as a so-called application-specific integrated circuit (ASIC), e.g., an integrated circuit (IC) customized for their particular use.
  • ASIC application-specific integrated circuit
  • the circuits may be implemented in CMOS, e.g., using a hardware description language such as Verilog, VHDL, etc.
  • the systems may comprise circuits for the evaluation of cryptographic primitives.
  • a processor circuit may be implemented in a distributed fashion, e.g., as multiple sub-processor circuits.
  • a storage may be distributed over multiple distributed sub-storages.
  • Part or all of the memory may be an electronic memory, magnetic memory, etc.
  • the storage may have volatile and a non-volatile part.
  • Part of the storage may be read-only.
  • Fig. 6 shows a computer readable medium 1000 having a writable part 1010.
  • Computer readable medium 1000 is shown in the form of an optically readable medium.
  • Computer readable medium 1000 may store data 1020 wherein the data may indicate instructions, which when executed by a processor system, cause a processor system to perform an embodiment of a method of performing an encrypted computation method, and/or a method of determining a test polynomial, according to an embodiment.
  • the data 1020 may represent a test polynomial for use in the encrypted computation method according to an embodiment.
  • the test polynomial may have been previously determined according to an embodiment.
  • the data 1020 may be embodied on the computer readable medium 1000 as physical marks or by magnetization of the computer readable medium 1000.
  • any other suitable embodiment is conceivable as well.
  • the computer readable medium 1000 is shown here as an optical disc, the computer readable medium 1000 may be any suitable computer readable medium, such as a hard disk, solid state memory, flash memory, etc., and may be non-recordable or recordable.
  • the computer program 1020 comprises instructions for causing a processor system to perform said method of performing a computation on encrypted values, e.g., LWE-encrypted values, or of determining a test polynomial.
  • Fig. 7 shows in a schematic representation of a processor system 1140 according to an embodiment of a device for performing an encrypted computation or determining a test polynomial.
  • the processor system comprises one or more integrated circuits 1110.
  • the architecture of the one or more integrated circuits 1110 is schematically shown in the figure.
  • Circuit 1110 comprises a processing unit 1120, e.g., a CPU, for running computer program components to execute a method according to an embodiment and/or implement its modules or units.
  • Circuit 1110 comprises a memory 1122 for storing programming code, data, etc. Part of memory 1122 may be read-only.
  • Circuit 1110 may comprise a communication element 1126, e.g., an antenna, connectors or both, and the like.
  • Circuit 1110 may comprise a dedicated integrated circuit 1124 for performing part or all of the processing defined in the method.
  • Processor 1120, memory 1122, dedicated IC 1124 and communication element 1126 may be connected to each other via an interconnect 1130, say a bus.
  • the processor system 1110 may be arranged for contact and/or contact-less communication, using an antenna and/or connectors, respectively.
  • processor system 1140 e.g., the device for performing the encrypted computation or determining the test polynomial, may comprise a processor circuit and a memory circuit, the processor being arranged to execute software stored in the memory circuit.
  • the processor circuit may be an Intel Core i7 processor, ARM Cortex-R8, etc.
  • the processor circuit may be ARM Cortex M0.
  • the memory circuit may be an ROM circuit, or a non-volatile memory, e.g., a flash memory.
  • the memory circuit may be a volatile memory, e.g., an SRAM memory.
  • the device may comprise a non-volatile software interface, e.g., a hard drive, a network interface, etc., arranged for providing the software.
  • the various components may be duplicated in various embodiments.
  • the processor 1120 may include multiple microprocessors that are configured to independently execute the methods described herein or are configured to perform steps or subroutines of the methods described herein such that the multiple processors cooperate to achieve the functionality described herein.
  • the various hardware components may belong to separate physical systems.
  • the processor 1120 may include a first processor in a first server and a second processor in a second server.
  • any reference signs placed between parentheses shall not be construed as limiting the claim.
  • Use of the verb 'comprise' and its conjugations does not exclude the presence of elements or steps other than those stated in a claim.
  • the article 'a' or 'an' preceding an element does not exclude the presence of a plurality of such elements.
  • Expressions such as "at least one of” when preceding a list of elements represent a selection of all or of any subset of elements from the list. For example, the expression, "at least one of A, B, and C" should be understood as including only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C.
  • the presently disclosed subject matter may be implemented by hardware comprising several distinct elements, and by a suitably programmed computer.
  • the device claim enumerating several parts several of these parts may be embodied by one and the same item of hardware.
  • the mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.
  • references in parentheses refer to reference signs in drawings of exemplifying embodiments or to formulas of embodiments, thus increasing the intelligibility of the claim. These references shall not be construed as limiting the claim.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Optimization (AREA)
  • Theoretical Computer Science (AREA)
  • Mathematical Analysis (AREA)
  • Computational Mathematics (AREA)
  • Pure & Applied Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • Algebra (AREA)
  • Databases & Information Systems (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Discrete Mathematics (AREA)
  • Storage Device Security (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Complex Calculations (AREA)

Claims (18)

  1. Ein kryptographisches verschlüsseltes Berechnungsverfahren (400), umfassend:
    - Erhalten (410) eines Geheimtextes, der einen Klartextwert verschlüsselt; und
    - Durchführen (420) einer Blindrotation des Geheimtextes gemäß einem Prüfpolynom,
    wobei die Blindrotation ein verschlüsseltes Polynomprodukt aus dem Prüfpolynom und einem Bootstrapping-Monom modulo eines Moduls (q) und modulo eines Quotientenpolynoms (p(Z))ergibt, wobei das Bootstrapping-Monom den Klartextwert als Exponent darstellt;
    wobei: das Quotientenpolynom (p(X)) ein NTT-Polynom (XM - 1) teilt, das eine zahlentheoretische Transformation modulo des Moduls (q)ermöglicht, Durchführen der Blindrotation das Durchführen (425) einer Polynom-Multiplikation unter Verwendung der zahlentheoretischen Transformation umfasst, und das Prüfpolynom definiert ist, sodass das Polynomprodukt einen gewünschten Ausgabewert für den Klartextwert als festen Koeffizienten aufweist.
  2. Das Verfahren (400) nach Anspruch 1, wobei der Geheimtext ein Geheimtext vom Typ LWE ist.
  3. Das Verfahren (400) nach Anspruch 2, wobei der Geheimtext durch Konvertieren aus einem Geheimtext vom Typ NTRU erhalten wird.
  4. Das Verfahren (400) nach Anspruch 1, wobei der Geheimtext ein Geheimtext vom Typ NTRU ist.
  5. Das Verfahren (400) nach einem vorstehenden Anspruch, umfassend das Durchführen eines programmierbaren Bootstrappings durch: Erhalten eines Eingabe-Geheimtextes; Durchführen eines Modulumschaltens auf dem Eingabe-Geheimtext, um den Geheimtext zu erhalten; Durchführen der Blindrotation; und Durchführen einer Stichprobenextraktion, um eine Verschlüsselung des festen Koeffizienten aus dem berechneten verschlüsselten Polynomprodukt zu extrahieren.
  6. Das Verfahren (400) nach einem vorstehenden Anspruch, wobei das Durchführen der Blindrotation das Berechnen eines externen Produkts eines Geheimtexts mit einem in einem Bootstrapping-Schlüssel umfassten Gadget-Geheimtext umfasst, wobei Polynom-Multiplikationen zum Berechnen des externen Produkts unter Verwendung der zahlentheoretischen Transformation durchgeführt werden.
  7. Das Verfahren (400) nach einem vorstehenden Anspruch, wobei das Quotientenpolynom nicht gleich XN + 1 ist.
  8. Das Verfahren (400) nach einem vorstehenden Anspruch, wobei der Grad des Quotientenpolynoms (N) streng größer ist als der halbe Grad des NTT-Polynoms (M).
  9. Das Verfahren (400) nach einem vorstehenden Anspruch, wobei der Modul (q) eine Zweierpotenz ist.
  10. Das Verfahren (400) nach einem der Ansprüche 1-8, wobei der Modul (q) eine Primzahl ist und der Grad des NTT-Polynoms (M) den Modul minus eins teilt.
  11. Das Verfahren (400) nach Anspruch 10, wobei der Modul gleich 10 · 318 + 1 oder 4 · 339 + 1 ist.
  12. Das Verfahren (400) nach einem vorstehenden Anspruch, wobei das Quotientenpolynom gleich ist XN + X N/2 + 1 oder XN - X N/2 + 1.
  13. Das Verfahren (400) nach einem vorstehenden Anspruch, wobei der Grad des NTT-Polynoms eine Dreierpotenz ist und der Grad des Quotientenpolynoms zwei Drittel des Grades des NTT-Polynoms beträgt.
  14. Das Verfahren (400) nach einem vorstehenden Anspruch, wobei der feste Koeffizient der konstante Koeffizient oder der führende Koeffizient ist.
  15. Ein Verfahren (500) zum Bestimmen eines Prüfpolynoms zur Verwendung bei dem verschlüsselten Berechnungsverfahren nach einem der Ansprüche 1-14, wobei das verschlüsselte Berechnungsverfahren das Berechnen eines Polynomprodukts aus einem Bootstrapping-Monom und einem Prüfpolynom modulo eines Moduls (q) und modulo eines Quotientenpolynoms (p(X)) umfasst und wobei das Quotientenpolynom (p(X)) ein NTT-Polynom teilt, wobei das Verfahren umfasst:
    - Erhalten (510) einer Nachschlagetabelle, die gewünschte Ausgabewerte für jeweilige Klartextwerte definiert;
    - Erhalten (520) des Moduls, des Quotientenpolynoms und des NTT-Polynoms; und
    - Berechnen (530) des Prüfpolynoms, sodass das Polynomprodukt die jeweiligen gewünschten Ausgabewerte als festen Koeffizienten für die jeweiligen Klartextwerte aufweist.
  16. Eine Vorrichtung (110,112) zur verschlüsselten Berechnung, umfassend;
    - einen Speicher (140) zum Speichern eines Geheimtextes, der einen Klartextwert verschlüsselt;
    - ein Prozessorteilsystem (130), das konfiguriert ist, um eine Blindrotation des Geheimtextes gemäß einem Prüfpolynom durchzuführen, wobei die Blindrotation ein verschlüsseltes Polynomprodukt aus dem Prüfpolynom und einem Bootstrapping-Monom modulo eines Moduls (q) und modulo eines Quotientenpolynoms (p(X))ergibt, wobei das Bootstrapping-Monom den Klartextwert als Exponent darstellt;
    wobei: das Quotientenpolynom (p(X)) ein NTT-Polynom (XM - 1) teilt, das eine zahlentheoretische Transformation modulo des Moduls (q)ermöglicht; Durchführen der Blindrotation das Durchführen einer Polynom-Multiplikation unter Verwendung der zahlentheoretischen Transformation umfasst, und das Prüfpolynom definiert ist, sodass das Polynomprodukt einen gewünschten Ausgabewert für den Klartextwert als festen Koeffizienten aufweist.
  17. Eine Vorrichtung (111,112,113,119) zum Bestimmen eines Prüfpolynoms zur Verwendung bei dem verschlüsselten Berechnungsverfahren nach einem der Ansprüche 1-14, wobei das verschlüsselte Berechnungsverfahren das Berechnen eines Polynomprodukts aus einem Bootstrapping-Monom und einem Prüfpolynom modulo eines Moduls (q) und modulo eines Quotientenpolynoms (p(X)) umfasst und wobei das Quotientenpolynom (p(X)) ein NTT-Polynom teilt, wobei die Vorrichtung umfasst:
    - einen Speicher (149) zum Speichern einer Nachschlagetabelle, die gewünschte Ausgabewerte für jeweilige Klartextwerte definiert;
    - ein Prozessorteilsystem (139), das konfiguriert ist, um:
    - den Moduls, das Quotientenpolynom und das NTT-Polynom zu erhalten; und
    - das Prüfpolynom zu berechnen, sodass das Polynomprodukt die jeweiligen gewünschten Ausgabewerte als festen Koeffizienten für die jeweiligen Klartextwerte aufweist.
  18. Ein transitorisches oder nicht-transitorisches computerlesbares Speichermedium (1000), das Daten umfasst, die Folgendes darstellen:
    - Anweisungen, die, wenn sie von einem Prozessorsystem ausgeführt werden, das Prozessorsystem veranlassen, das Verfahren nach einem der Ansprüche 1-14 durchzuführen und/oder das Verfahren nach Anspruch 15 durchzuführen, und/oder
    - ein Prüfpolynom zur Verwendung beim verschlüsselten Berechnungsverfahren gemäß einem der Ansprüche 1-14.
EP22821542.2A 2021-12-07 2022-11-24 Verschlüsselte berechnung mit einer blinden rotation Active EP4352913B1 (de)

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
EP21290080.7A EP4195577A1 (de) 2021-12-07 2021-12-07 Verschlüsselte berechung mit einer blinden rotation
EP22315182 2022-08-11
PCT/EP2022/083120 WO2023104531A1 (en) 2021-12-07 2022-11-24 Encrypted computation comprising a blind rotation

Publications (2)

Publication Number Publication Date
EP4352913A1 EP4352913A1 (de) 2024-04-17
EP4352913B1 true EP4352913B1 (de) 2024-11-06

Family

ID=84462805

Family Applications (1)

Application Number Title Priority Date Filing Date
EP22821542.2A Active EP4352913B1 (de) 2021-12-07 2022-11-24 Verschlüsselte berechnung mit einer blinden rotation

Country Status (7)

Country Link
US (1) US12517975B2 (de)
EP (1) EP4352913B1 (de)
JP (1) JP2024546472A (de)
KR (1) KR102887786B1 (de)
CN (1) CN118369889B (de)
IL (1) IL312947B2 (de)
WO (1) WO2023104531A1 (de)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP4195578B1 (de) * 2021-12-13 2024-02-07 Zama SAS Polynomiale multiplikation verschlüsselter werte
EP4307606A1 (de) * 2022-07-12 2024-01-17 Electronics and Telecommunications Research Institute Beschleunigervorrichtung und betriebsverfahren einer beschleunigervorrichtung
CN121713438A (zh) * 2023-06-21 2026-03-20 华为技术有限公司 一种基于同态加密的安全方法及装置
FR3150382A1 (fr) * 2023-06-21 2024-12-27 Ravel Technologies Procédé pour détecter la présence d'un élément chiffré homomorphe dans un ensemble chiffré homomorphe
CN121713439A (zh) * 2023-08-10 2026-03-20 华为技术有限公司 一种电路自举的方法和装置
CN120050021B (zh) * 2025-02-21 2025-12-12 西安电子科技大学 基于误差分析的ckks型全同态加密方案的参数评估方法
CN121151512B (zh) * 2025-11-18 2026-02-24 苏州城市学院 一种基于代数结构变换图像加密与解密方法

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3402118A1 (de) 2017-05-10 2018-11-14 Koninklijke Philips N.V. Schlüsselvereinbarungsvorrichtungen und verfahren
DE102018108313A1 (de) 2018-04-09 2019-10-10 Infineon Technologies Ag Verfahren und Verarbeitungsvorrichtung zum Ausführen einer kryptografischen Operation auf Gitterbasis
JP7146725B2 (ja) * 2019-11-22 2022-10-04 Kddi株式会社 秘匿演算装置、秘匿演算方法及び秘匿演算プログラム
EP4087177A1 (de) 2021-05-04 2022-11-09 Zama SAS Blinddrehung zur verwendung in vollständig homomorpher verschlüsselung
US12432043B2 (en) * 2021-11-26 2025-09-30 Samsung Electronics Co., Ltd. Homomorphic encryption apparatus and method

Also Published As

Publication number Publication date
KR20240110666A (ko) 2024-07-15
IL312947B1 (en) 2025-10-01
IL312947B2 (en) 2026-02-01
WO2023104531A1 (en) 2023-06-15
CN118369889A (zh) 2024-07-19
US12517975B2 (en) 2026-01-06
EP4352913A1 (de) 2024-04-17
KR102887786B1 (ko) 2025-11-17
CN118369889B (zh) 2025-03-04
JP2024546472A (ja) 2024-12-24
IL312947A (en) 2024-07-01
US20250036714A1 (en) 2025-01-30

Similar Documents

Publication Publication Date Title
US12517975B2 (en) Encrypted computation comprising a blind rotation
US20240267222A1 (en) Computation on lwe-encrypted values
US12143467B2 (en) Encrypted scalar multiplication
EP4195578B1 (de) Polynomiale multiplikation verschlüsselter werte
JP7840989B2 (ja) 完全準同型暗号化で使用するためのブラインド回転
EP4096148A1 (de) Berechnung von lwe-verschlüsselten werten
EP4087177A1 (de) Blinddrehung zur verwendung in vollständig homomorpher verschlüsselung
EP4195577A1 (de) Verschlüsselte berechung mit einer blinden rotation
EP4344121B1 (de) Verschlüsselte berechnung mit blindrotation
EP4449666B1 (de) Berechnung von codierten und verschlüsselten werten
EP4573693B1 (de) Schlüsselsätze mit gemeinsamen oder vordefinierten elementen

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: UNKNOWN

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20240109

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC ME MK MT NL NO PL PT RO RS SE SI SK SM TR

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20240530

INTG Intention to grant announced

Effective date: 20240613

TPAC Observations filed by third parties

Free format text: ORIGINAL CODE: EPIDOSNTIPA

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC ME MK MT NL NO PL PT RO RS SE SI SK SM TR

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602022007571

Country of ref document: DE

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG9D

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20250306

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20250306

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1740577

Country of ref document: AT

Kind code of ref document: T

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20250206

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20250207

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20250206

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20241124

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602022007571

Country of ref document: DE

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20241130

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20241106

26N No opposition filed

Effective date: 20250807

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20241130

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20241124

REG Reference to a national code

Ref country code: CH

Ref legal event code: U11

Free format text: ST27 STATUS EVENT CODE: U-0-0-U10-U11 (AS PROVIDED BY THE NATIONAL OFFICE)

Effective date: 20251201

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20251128

Year of fee payment: 4

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20251125

Year of fee payment: 4

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: CH

Payment date: 20251201

Year of fee payment: 4

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20221124

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT; INVALID AB INITIO

Effective date: 20221124